Google Chrome Rolls Out Device-Bound Session Credentials to Block Cookie Theft

Google has made Device Bound Session Credentials (DBSC) generally available in Chrome, rolling it out for Google Workspace customers, Workspace Individual subscribers, and personal Google accounts to blunt account takeovers driven by stolen session cookies. The feature cryptographically binds a session cookie to the device where authentication occurred, using hardware-backed protections such as the Trusted Platform Module on Windows and Secure Enclave support on macOS, so exfiltrated cookies cannot be replayed on another machine to bypass MFA. Google said DBSC is enabled by default for Workspace customers, integrates with Context-Aware Access for device-aware policy decisions, and exposes binding events in audit logs to help administrators monitor session integrity.

The move follows sustained abuse of stolen Google authentication artifacts by infostealers and adversaries leveraging mechanisms such as the undocumented OAuth MultiLogin API, with operators tied to Lumma and Rhadamanthys claiming they could restore expired cookies. At the same time, researchers at Phishu disclosed VaultJacking, a phishing technique that can steal an entire Google Password Manager vault after capturing a victim’s 6-digit PIN, then registering an attacker-controlled device to sync passwords and passkeys without malware or prior device compromise. Phishu said the attack sidesteps DBSC because it does not rely on replaying stolen cookies, underscoring that Google’s new protection sharply reduces pass-the-cookie risk but does not stop credential- and PIN-based phishing against synced account data.